Overview

overview

10

Static

static

10

VixenPrivate.exe

windows7-x64

10

VixenPrivate.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    29-12-2024 21:55

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    VixenPrivate.exe

  • Size

    63KB

  • MD5

    52d017d32bef7cffcb7ff98571736a97

  • SHA1

    f0764f6bec89063594e5afcf2233d586da2fa999

  • SHA256

    20e65c2d214ec536e42d4ce447afaa253b5cd9293fcd759e64023dd891dab6f2

  • SHA512

    538ea5e3b6516b63fe803a6e158b00a286fa3016df24a25f59e6a9b1ff3b01ad7876aff3efb8d474cf410d22db7b745698be46f6ae1f11ae819590607a2b999f

  • SSDEEP

    1536:SwXz4zflrUYJYUbBh9bFq7+MOGxuUdpqKmY7:SkUlbYUbBeFfGz

Score
10/10
asyncratxwormdefaultexecutionrattrojan

Malware Config

Extracted

Family

asyncrat

Botnet

Default

C2

100.37.20.232:4872

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain

Extracted

Family

xworm

C2

100.37.20.232:4872

Attributes
  • Install_directory

    %LocalAppData%

  • install_file

    XClient.exe

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat
  • Asyncrat family
    asyncrat
  • Detect Xworm Payload 2 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Xworm family
    xworm
  • Executes dropped EXE 1 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Start PowerShell.

    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\VixenPrivate.exe
    "C:\Users\Admin\AppData\Local\Temp\VixenPrivate.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2636
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\ngxama.exe"' & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:352
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\ngxama.exe"'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1428
        • C:\Users\Admin\AppData\Local\Temp\ngxama.exe
          "C:\Users\Admin\AppData\Local\Temp\ngxama.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:2272

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Cab5CD2.tmp
    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\Tar5DAF.tmp
    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\ngxama.exe
    Filesize

    66KB

    MD5

    84cc950a60b2e460687978967ed32191

    SHA1

    31cdcaacf713d244f6427bac4592626b3599c11c

    SHA256

    e4463cd0f170cafa992be4093500d4e1be51949bfaca981e414c91d16b600158

    SHA512

    3c7a2befd57516a2f196879555ab9ef451443205e1ef9de456de516754968c99ca01c2d53ffcf2fe9005cdc6616e881f160a351825a4202af6a443e3178fc854

    Download Submit

  • memory/1428-68-0x00000000027A0000-0x00000000027A8000-memory.dmp

    Filesize

    32KB

    Download

  • memory/1428-67-0x000000001B4C0000-0x000000001B7A2000-memory.dmp

    Filesize

    2.9MB

    Download

  • memory/2272-71-0x0000000000170000-0x0000000000186000-memory.dmp

    Filesize

    88KB

    Download

  • memory/2636-3-0x000007FEF55D0000-0x000007FEF5FBC000-memory.dmp

    Filesize

    9.9MB

    Download

  • memory/2636-22-0x000007FEF55D0000-0x000007FEF5FBC000-memory.dmp

    Filesize

    9.9MB

    Download

  • memory/2636-24-0x0000000000440000-0x0000000000474000-memory.dmp

    Filesize

    208KB

    Download

  • memory/2636-21-0x000007FEF55D0000-0x000007FEF5FBC000-memory.dmp

    Filesize

    9.9MB

    Download

  • memory/2636-43-0x0000000000480000-0x00000000004B2000-memory.dmp

    Filesize

    200KB

    Download

  • memory/2636-20-0x000007FEF55D3000-0x000007FEF55D4000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2636-0-0x000007FEF55D3000-0x000007FEF55D4000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2636-2-0x000007FEF55D0000-0x000007FEF5FBC000-memory.dmp

    Filesize

    9.9MB

    Download

  • memory/2636-1-0x0000000000B80000-0x0000000000B96000-memory.dmp

    Filesize

    88KB

    Download